Geeh98

Guide to Assembly on Wii

Jul 25th, 2015
648
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 4.70 KB | None | 0 0
  1. Introduction to PowerPC assembly (Especially for Wii):
  2. If you're not familiar with Von Neumann's 'theory', I can sorta semplify it up for you:
  3. A computer is made up of RAM, CPU, and I/O devices, each communicating through the processor.
  4. This is what we do when we boot up our good old USB Gecko through the debugger: We control the processor, instruction per instruction.
  5.  
  6. Some concepts however have to be grasped before we get into that:
  7. Wii has four different types of memory: 0x80, 0x90, 0xC0, 0xD0, what we really are covering in this tutorial regards 0x80 memory, which is the cached version of the 0xC0, i believe.
  8. In MKWii, memory is divided in 'sectors', what we call the executable program and data, as Hamster35000Vr's "Hacking in 15 steps" states:
  9. "80000000 – 80400000 = The Wii’s basic functions, variables, etc. Also some ASM and pointers.
  10. • 80400000 – 80880000 = 90% ASM. Practically no floating points or integers. You may find a pointer at the beginning of this region.
  11. • 80880000 – 80980000 = Constants. This is where most single-lined codes write values. Rarely anything else.
  12. • 80980000 – 80A80000 = Mostly pointers. Rare constants here and there. Some values whose addresses never change occasionally live here.
  13. • 80A80000 – 81780000 = DMA (Dynamic Memory Allocation). If you find a value here, you’ll need to use a pointer.
  14. • 81780000 – 81800000 = Strings, File Names (fun to mess with), etc."
  15. Something has to be added, which is the handler's code list located in 0x800028B8 -> 0x80003000 and the >STACK< located around 0x80300000.
  16. The concept of stack is something we'll cover later.
  17. Perfect, so you know how MKWii's ram is divided in, what can we do about it?
  18. I assume most of you can do value searches, especially you Rob, so i'll skip this. Let's say you found the value that holds your item. (By the way, four kinds of value: Float (Single - Double), int (unsigned/signed, 8,16,32 bits), bool (Rarely used, it's 1 byte long), char (Sometimes used, can be signed/unsigned (Althrough signed char is NEVER used, and stupid imo), take up 1 byte unless it's a string).
  19. So you found the value that holds your current item, it's an unsigned 32 bit value and items go from 0 to 0x10 (Assuming), and you want to make items cycle, what do you do?
  20. 1. You set a read (or write) breakpoint on the value, so we have an address to inject our code to and an already - ready pointer (Assuming there's NO OTHER PLAYER for easiness)
  21. So we have this address, it's time to
  22. 2. write an assembly code for it
  23. Assembly basically tells the processor what to do. Wii's processor has 32 General Purpose Registers (int), 32 FPR (float) and some other special registers which we'll cover another time.
  24. You should see registers as "A sheet of paper that the processors uses to help with calculations" (Thanks to XeR for the example), kind of when you're doing a very difficult division by hand, you put the numbers somewhere to be used again when you need them.
  25. What we want to do is make this value of items increase, from 0x00 to 0x10 then when it hits 0x10, it should be reset to 0x00. Of course this will result in a very speedy item rotation due to the amount of times the address breaks, but that's something we WILL cover another time.
  26. So, what we do is:
  27. 1. Get the value of the item
  28. 2. Increase the value
  29. 3. see if it's bigger than 0x10
  30. a. if it is, reset the register holding the value to 0x00
  31. 4. store the value
  32.  
  33.  
  34. Here's an example, assuming that the pointer is in r3 (say it's 0x800001234) and that our unused register is r15:
  35. Memory:
  36. 0x80001230: 0x00000001
  37. 0x80001234: 0x00000003
  38. 0x80001238: 0x00000005
  39.  
  40. r3 is currently 0x80001230
  41.  
  42. lwz r15,4(r3) ; lwz takes a WORD from the pointer in r3 (+4[Therefore 0x80001230 + 4]), and puts the value contained in this pointer in r15.
  43. r15 will now contain 0x00000003
  44. addi r15,r15,1 ;add - immediate adds a constant value that we specify as third operand ('1') to a a register ( addi rA,rB,X -> rA = rB + x )
  45. r15 will now hold 0x00000004
  46. cmpwi r15,0x10 ; compare word IMMEDIATE compares the value in r15 with a value we specify as second operand (0x10)
  47. blt skip ; if r15 holds a value LESS THAN 0x10 (bxx -> xx = condition such as less than (lt), greater than (gt), not equal (ne), equal (eq) and so on..)
  48. So if r15 holds a value that's lower than 0x10, the CPU will 'jump' to the instruction after the etiquette 'skip'
  49. li r15,0 ; li > load immediate, resets a register and sets it to the value we specify in the second operand, '0'. This li will ONLY be executed if r15 held a value bigger than or equal to 0x10 (because of the previous compare)
  50. skip:
  51. stw r15,4(r3) ; stw STORES a WORD (contained in r15) in the pointer in r3, adding +4 to it.
  52.  
  53. ---End of first tutorial
Advertisement
Add Comment
Please, Sign In to add comment